That's only when using Luma. For example, if you take a stock NATIVE_FIRM (aka what the console boots when it's not hacked*), boot it (through boot.firm or luma chainload), and do a system update, it will overwrite B9S because NATIVE_FIRM doesn't protect F0F1 because if they're protected, they can't be updated. Since the same thing happens here, that means that the firm protection is broken because it doesn't protect F0F1 (aka where B9S/Fastboot is installed) from being overwritten by an update.
*so technically it boots FIRM0, then FIRM1 if F0's corrupted, but they're both copies of NATIVE_FIRM (which also exists on the console for some reason? I don't think plain NATIVE_FIRM is ever officially used), B9S installs to FIRM0 (depending on your install method it might also be on FIRM1) and cfws just load NATIVE_FIRM instead.
